TELEPUZ CipherAllocator Service Registration for Persistence
This rule detects the registration of the 'CipherAllocator' Windows service associated with the TELEPUZ malware. It monitors registry modifications related to service creation, specifically identifying the usage of 'grpeng.dll' from a suspicious path ('C:\ProgramData\XeroxPrint\Temp\Worker\') and specific 'svchost' registry configurations used for persistence.
Microsoft Sentinel (KQL)
